bacula...elinux(8)

💅 NAME (aka who is she)

bacula_unconfined_script_selinux — the Security Enhanced Linux Policy for the bacula_unconfined_script processes. That's the whole vibe. It's the SELinux policy page for those bacula unconfined script processes, and yes bestie, we're getting into it 💖

---

✨ DESCRIPTION ✨

So Security-Enhanced Linux secures the bacula_unconfined_script processes via flexible mandatory access control. That's the whole deal — SELinux is the bouncer at the club and it decides who gets in 🔥

The bacula_unconfined_script processes execute with the bacula_unconfined_script_t SELinux type. Wanna check if you've got these processes running? Just run the ps command with the -Z qualifier, like:

ps -eZ | grep bacula_unconfined_script_t

That's it. That's the vibe check 🫶

---

🚪 ENTRYPOINTS

The bacula_unconfined_script_t SELinux type can be entered via the bacula_unconfined_script_exec_t file type. That's the doorway, iykyk.

The default entrypoint paths for the bacula_unconfined_script_t domain are the following:

...and then it just ends 💀 The list is literally empty in the source — no default entrypoint paths are listed at all. Not me leaving you on read, that's genuinely what's there 🙈

---

👑 PROCESS TYPES

SELinux defines process types (domains) for each process running on the system. Very main character energy of it.

You can see the context of a process using the -Z option to ps ⭐

Policy governs the access confined processes have to files. The SELinux bacula_unconfined_script policy is very flexible, allowing users to set up their bacula_unconfined_script processes in as secure a method as possible. Secure AND flexible, we love to see it 💅

The following process types are defined for bacula_unconfined_script:

• bacula_unconfined_script_t

Note: semanage permissive -a bacula_unconfined_script_t can be used to make the process type bacula_unconfined_script_t permissive. SELinux does not deny access to permissive process types, but the AVC (SELinux denials) messages are still generated. So it's chill about it, but it's still taking notes 📝

---

🎀 BOOLEANS

SELinux policy is customizable based on least access required. The bacula_unconfined_script policy is extremely flexible and has several booleans that allow you to manipulate the policy and run bacula_unconfined_script with the tightest access possible. Tightest access possible, periodt ✨

Every single one of these is disabled by default, just so you know 👑

• deny_execmem — if you want to deny user domains applications to map a memory region as both executable and writable, turn this on. Bestie, this is dangerous and the executable should be reported in bugzilla. Disabled by default.

setsebool -P deny_execmem 1

• mmap_low_allowed — if you want to control the ability to mmap a low area of the address space, as configured by /proc/sys/vm/mmap_min_addr, turn this on. Disabled by default.

setsebool -P mmap_low_allowed 1

• secure_mode_insmod — if you want to disable kernel module loading, turn this on. Disabled by default.

setsebool -P secure_mode_insmod 1

• selinuxuser_execheap — if you want to allow unconfined executables to make their heap memory executable, turn this on. Doing this is a really bad idea 🚩 Probably indicates a badly coded executable, but could indicate an attack. This executable should be reported in bugzilla. Disabled by default.

setsebool -P selinuxuser_execheap 1

• selinuxuser_execstack — if you want to allow unconfined executables to make their stack executable, turn this on. This should never, ever be necessary, no cap 😭 Probably indicates a badly coded executable, but could indicate an attack. This executable should be reported in bugzilla. Disabled by default.

setsebool -P selinuxuser_execstack 1

---

🗂️ MANAGED FILES

The SELinux process type bacula_unconfined_script_t can manage files labeled with the following file types. The paths listed are the default paths for these file types. Note: the process's UID still needs to have DAC permissions — SELinux isn't out here doing DAC's job for it, fr fr 🦋

• file_type
  • all files on the system

---

🛠️ COMMANDS

• semanage fcontext can also be used to manipulate default file context mappings.
• semanage permissive can also be used to manipulate whether or not a process type is permissive.
• semanage module can also be used to enable/disable/install/remove policy modules.
• semanage boolean can also be used to manipulate the booleans.
• system-config-selinux is a GUI tool available to customize SELinux policy settings. A whole GUI bestie, for when the terminal isn't the mood 🌈

---

🌸 AUTHOR

This manual page was auto-generated using sepolicy manpage . Slay, automated content ✨

---

🔗 SEE ALSO

selinux(8), bacula_unconfined_script(8), semanage(8), restorecon(8), chcon(1), sepolicy(8), setsebool(8)

---

and that's the whole page, bestie 🎀 brought to you by bacula_unconfined_script, dated 26-10-06 — go forth and configure your SELinux policy responsibly, mwah 💜